False Positive Cases

False Positive Cases

Real false positive cases from operators, and how they were resolved. Add your own — edit this page.

---

Format

### [Brief description]
**OS:** ...
**Cause:** What touched the decoy
**Resolution:** How to prevent recurrence

---

Cases

Time Machine touching a decoy placed inside ~/.aws/

OS: macOS
Cause: Time Machine backs up the entire home directory, including ~/.aws/. A decoy placed at ~/.aws/credentials.decoy was read on every backup cycle — triggering a read-class notification roughly every hour.
Resolution: Move decoys to a dedicated directory (~/Documents/zee-decoys/) and add that directory to Time Machine's exclusion list (System Settings → General → Time Machine → Options → Exclude).
Notes: Change-class touches (op_class=change) are NOT triggered by backup reads, so auto-cut never fired. Only read-class notifications were generated. This is by design — the trigger-limited responder exists precisely to avoid this pattern.

---

No cases yet? Add the first one.